WO2012142943A1

WO2012142943A1 - Method and device for defense by using sandbox, and secure browser

Info

Publication number: WO2012142943A1
Application number: PCT/CN2012/074241
Authority: WO
Inventors: 范纪鍠; 潘剑锋; 孙晓骏; 路健华
Original assignee: 北京奇虎科技有限公司
Priority date: 2011-04-21
Filing date: 2012-04-18
Publication date: 2012-10-26
Also published as: CN102184356B; CN102184356A

Abstract

This application provides a method and a device for defense by using a sandbox, and a secure browser, so as to solve the problem of a sandbox technology where a user performs selection in the prior art. The method comprises: before executing an operation on a target object, automatically judging whether execution of the target object to be operated needs to be introduced into a sandbox; and if it is determined that the execution of the target object needs to be introduced into the sandbox, introducing the target object into the sandbox and completing the execution of the target object in the sandbox. In this application, before a user executes an operation on a target object, it is automatically judged whether the execution of the target object needs to be introduced into the sandbox, so as to help the user to decide which risky programs need to be run in the sandbox.

Description

Method, device and secure browser for using sandbox for defense

The present application relates to the field of computer security technologies, and in particular, to a method and device for defending by using a sandbox and a secure browser.

Say

Background technique

In the field of computer security, the sandbox (also known as the sandbox) is a program's isolated operating mechanism that is designed to restrict the permissions of untrusted processes. Sandbox technology is often used to execute untested or untrustworthy client programs. In order to prevent untrusted programs from disrupting the operation of other programs in the book, sandboxing technology provides virtualized disk, memory, and network resources for untrusted clients, and this virtualization is transparent to the client. Because the resources in the sandbox are virtualized (or indirectly), the malicious behavior of untrusted programs in the sandbox is often confined to the sandbox, protecting the original state of the system.

Specifically, sandbox technology can put a program into a sandbox, so that all files and registry created, modified, and deleted by the program will be redirected by virtualization, that is, all operations are virtual, true. The files and registry will not be altered, which will ensure that the virus cannot make changes to critical parts of the system and damage the system.

Currently sandbox technology offers two types of sandboxes: one is a specific sandbox, for example:

Chrome (a browser) uses sandbox technology to put the rendering engine or Flash in a sandbox to keep the browser safe; there is also a universal sandbox, such as: Sandboxie (another browser) Provide the user with a sandbox, let the user choose the software program to run in the sandbox.

Compared with the specific sandbox, the above-mentioned universal sandbox selected by the user provides users with more flexibility and greatly facilitates the user's use. However, there are several problems with this way of making users choose:

The first problem is that the user must judge which is a risky program and needs to be placed in a sandbox. If the user does not understand the characteristics of the program, he or she may choose an error. Problem 2, Incorrect use of the sandbox, such as placing the editor of the editing file in the sandbox, will result in file loss.

Question 3: The user-selected method is not easy to use, and the operation is complicated, which does not meet the user's operating habits. Summary of the invention

The present application provides a method, a device and a secure browser for defending by using a sandbox to solve

>之—. In order to solve the above problem, the present application discloses a method for defending by using a sandbox, comprising: automatically determining whether execution of the target object to be operated needs to be imported into a sandbox before performing an operation on the target object; The sandbox then imports the target object into the sandbox and performs execution of the target object in the sandbox.

Preferably, the step of importing the target object into the sandbox and completing execution of the target object in the sandbox comprises: if the target object is a target program, importing the target program into a sandbox, in the sand The operation of the target program is completed in the box; if the target object is a target file, the associated program that executes the target file is imported into the sandbox, and the target file is run by the associated program in the sandbox; if the target object For the information input by the user, the associated program that receives the user input information is imported into the sandbox, and the associated program is run according to the user input information in the sandbox; the information input by the user includes a web address and/or a keyword.

Preferably, the step of automatically determining whether the execution of the target object to be operated needs to be imported into the sandbox before performing the operation on the target object comprises: downloading the target program to the target program if the target object is a target program After the client runs, before the client runs the target program, it automatically determines whether the execution of the target object to be operated needs to be imported into the sandbox; and/or automatically determines the target to be operated before downloading the target program. Whether the execution of the object needs to be imported into the sandbox; if the target object is the target file, after the target file or the associated program that executes the target file is downloaded to the client, the client automatically determines before the target file is run. Whether the execution of the target object of the operation needs to be imported into the sandbox; and/or automatically determining whether the execution of the target object to be operated is required before downloading the target file or executing the associated program of the target file online Importing a sandbox; if the target object is information input by the user, when the user inputs the information, it is automatically determined whether the execution of the target object to be operated needs to be imported into the sandbox.

Preferably, the step of automatically determining whether the execution of the target object to be operated needs to be imported into the sandbox comprises: determining whether the target object to be operated meets a preset matching rule, and if yes, the to-be-operated The execution of the target object needs to be imported into the sandbox; if it is not, you do not need to import the sandbox.

Preferably, before the step of determining whether the target object to be operated meets the preset matching rule, the method further includes: creating a process for automatically determining execution of the target object; determining whether the parent process of the process is in the sand In the box, if yes, performing the step of importing the target object into the sandbox and completing execution of the target object in the sandbox; if not, continuing to determine whether the target object to be operated is The steps to match the preset matching rules.

Preferably, before the step of determining whether the target object to be operated meets the preset matching rule, the method further comprises: determining whether the user selects to import the execution of the target object to be operated into the sandbox, and if yes, executing the The step of importing the target object into the sandbox and completing execution of the target object in the sandbox; if not, continuing to determine whether the target object to be operated conforms to a preset matching rule.

Preferably, before determining whether the target object to be operated meets the preset matching rule, the method further includes: determining whether the target object to be operated is in a white list, and if not in the white list, the to-be-operated The target object is an unknown object, and the step of judging whether the target object to be operated meets the preset matching rule is continued; if in the white list, the sandbox does not need to be imported.

Preferably, before determining whether the target object to be operated meets the preset matching rule, the method further includes: determining whether the target object to be operated is in a blacklist, and if in the blacklist, executing the And the step of importing the target object into the sandbox and completing the execution of the target object in the sandbox; if not in the blacklist, continuing to determine whether the target object to be operated meets the preset matching rule.

Preferably, determining whether the target object to be operated meets a preset matching rule comprises: querying a preset database, and comparing the target object to be operated with a preset rule in the database, if the database is in the database If it is queried, it will match the matching rule; if it is not queried, it will not match Match rules.

Preferably, when the target object to be operated is the target program and/or the target file, determining whether the target object to be operated meets the preset matching rule comprises: determining, according to the information of the target object, the Whether the target object conforms to a preset matching rule; and/or, according to information of the source program of the target object, whether the target object meets a preset matching rule.

Preferably, the information of the target object includes at least one of the following: a file path of the target object, encrypted data, a file attribute, an icon feature value, a file feature value, a download source; and the information of the source program includes at least one of the following: Source file path, encrypted data, file attributes, icon feature values, file feature values, download source.

Preferably, when the target object to be operated is the information input by the user, determining whether the target object to be operated meets the preset matching rule comprises: determining whether the information input by the user meets a preset matching rule .

Preferably, the step of automatically determining whether the execution of the target object to be operated needs to be imported into the sandbox comprises: automatically determining, by the server end, whether the execution of the target object to be operated needs to be imported into the sandbox according to the request of the client; And/or, the client automatically determines whether the execution of the target object to be operated needs to be imported into the sandbox.

Preferably, if the execution of the target object to be operated needs to be imported into the sandbox, before the importing the sandbox, the method further includes: popping up the prompt window to prompt the user whether to import the sandbox, and importing the target object according to the positive input of the user The sandbox completes execution of the target object in the sandbox. The present application also provides a computer readable recording medium having recorded thereon a method for performing the above-described defense using a sandbox. The application also provides a device for defending by using a sandbox, comprising:

a judging module, configured to automatically determine whether execution of the target object to be operated needs to be imported into a sandbox before performing an operation on the target object;

The execution module is configured to: if the judgment result of the determination module is that the sandbox needs to be imported, import the target object into the sandbox and complete execution of the target object in the sandbox.

Preferably, the execution module introduces the target object into the sandbox and in the sandbox When the execution of the target object is completed,

If the target object is a target program, the target program is imported into a sandbox to complete the operation of the target program in the sandbox;

If the target object is a target file, import the associated program that executes the target file into the sandbox, and the target file is run by the associated program in the sandbox;

If the target object is information input by the user, importing the associated program that receives the user input information into a sandbox, and running the associated program according to the user input information in the sandbox; the information input by the user includes a web address and/or Or keywords.

Preferably, the determining module is configured to: if the target object is a target program, download the target program to the client, and automatically determine the target object to be operated before the client runs the target program Whether the execution needs to import the sandbox; and/or, before downloading the target program, automatically determining whether the execution of the target object to be operated needs to be imported into the sandbox;

If the target object is a target file, downloading the target file or the associated program executing the target file to the client, and automatically determining whether the execution of the target object to be operated is required before the client runs the target file Importing a sandbox; and/or automatically determining whether execution of the target object to be operated needs to be imported into a sandbox before downloading the target file or executing an associated program of the target file online;

If the target object is information input by the user, when the user inputs the information, it is automatically determined whether the execution of the target object to be operated needs to be imported into the sandbox.

Preferably, the determining module includes: a rule determining module, configured to determine whether the target object to be operated meets a preset matching rule before performing an operation on the target object, and if yes, the target object to be operated The execution needs to be imported into the sandbox; if it is not, you do not need to import the sigma phase.

Preferably, the determining module further includes: a parent process determining module, configured to: before the rule determining module determines whether the target object to be operated meets a preset matching rule, create a method for automatically determining the target object After executing the process, determining whether the parent process of the process is in a sandbox, and if so, triggering the execution module to import the target object into the sandbox and complete execution of the target object in the sandbox If not, triggering the rule determination module to continue to determine the location Whether the target object of the operation is consistent with the preset matching rule.

Preferably, the determining module further includes: a user selection determining module, configured to determine whether the user selects to import the execution of the target object to be operated into the sandbox, and if yes, trigger the execution module to import the target object The sandbox completes execution of the target object in the sandbox; if not, triggering the rule determination module to continue to determine whether the target object to be operated meets a preset matching rule.

Preferably, the determining module further includes: a whitelist determining module, configured to determine whether the target object to be operated is in a whitelist, and if not in the whitelist, the target object to be operated is an unknown object, triggering The rule judging module continues to determine whether the target object to be operated meets the preset matching rule; if in the white list, the sandbox does not need to be imported.

Preferably, the determining module further includes: a blacklist determining module, configured to determine whether the target object to be operated is in a blacklist, and if in the blacklist, triggering the executing module to import the target object The sandbox is completed and the execution of the target object is completed in the sandbox; if not in the blacklist, the rule determination module is triggered to continue to determine whether the target object to be operated conforms to a preset matching rule.

Preferably, the rule determining module is configured to: determine, according to the information of the target object, whether the target object meets a preset matching rule, when the target object to be operated is a target program and/or an object file; And/or, determining, according to the information of the source program of the target object, whether the target object meets a preset matching rule;

The information of the target object includes at least one of the following: a file path of the target object, an encrypted data, a file attribute, an icon feature value, a file feature value, and a download source; the information of the source program includes at least one of the following: File path of the program, encrypted data, file attributes, icon feature values, file feature values, download sources;

When the target object to be operated is information input by the user, it is determined whether the information input by the user conforms to a preset matching rule.

Preferably, the device further includes: a prompting module, configured to: after the execution module determines that the sandbox needs to be imported, import the target object into the sandbox and complete execution of the target object in the sandbox , a pop-up prompt window prompts the user whether to import the sandbox; and according to the user's affirmation The input invokes the execution module to import the target object into the sandbox and complete execution of the target object in the sandbox. The present application also provides a secure browser including the device for defense using a sandbox as described above. Compared with the prior art, the present application includes the following advantages:

First, the present application provides a method for intelligent determination, which can automatically determine whether the execution of the target object needs to be imported into a sandbox before the user performs an operation on the target object, thereby bringing the following advantages:

First, it can help users decide which risky programs need to be run in the sandbox without the user's own judgment;

Secondly, avoiding the loss of user data by placing the safe and risk-free program in the sandbox; Thirdly, without the user's participation, the user's operation is not affected, and the ease of use is high.

Secondly, the target object described in the present application may be not only the target program but also the target file or information input by the user. Therefore, the present application can not only automatically judge some software programs, but also automatically judge whether the execution of files such as pictures is safe, and can also automatically judge the information such as the URL and keywords input by the user, if the website or keyword Is a movie website, open a new browser to browse the website in the sandbox. DRAWINGS

1 is a flowchart of a method for defending by using a sandbox according to an embodiment of the present application; FIG. 2 is a flowchart of a method for defending by using a sandbox according to a preferred embodiment of the present application; FIG. 3 is a preferred implementation of the present application. An example of a device structure for using a sandbox for defense. detailed description

The above described objects, features and advantages of the present invention will become more apparent from the detailed description.

For systems employing sandbox technology, the present application provides an intelligent decision method, which can Before the user performs an operation on the target object, it is automatically determined whether the execution of the target object needs to be imported into the sandbox, thereby helping the user decide which risky programs need to run in the sandbox.

The details will be described below by way of examples. Referring to FIG. 1 , it is a flowchart of a method for defending by using a sandbox according to an embodiment of the present application. Step 101: Before performing an operation on the target object, trigger the following defense steps;

Step 102: The target object to be operated is automatically determined whether the execution of the target object needs to be imported into a sandbox;

If yes, go to step 103; if no, go to step 104.

Step 103: If the sandbox needs to be imported, the execution of the target object is completed in the sandbox. Step 104: If the sandbox does not need to be imported, the execution of the target object is completed outside the sandbox. That is, the target object is executed according to the normal processing flow.

Preferably, if the execution of the target object to be operated needs to be imported into the sandbox, before the sandbox is imported, a prompt window may be popped up to prompt the user to import the sandbox, so that the user can freely select according to the result of the automatic judgment.

In the above embodiment, the target object includes, but is not limited to, a target program, an object file, and information input by the user. The details are described below separately.

(1) Target procedure

The target program is generally referred to as an executable file such as an e-book, an online player, a serial number generator, and the like.

The user can trigger the execution of step 102 in a plurality of manners, including but not limited to: after downloading the target program to the client, by double-clicking or clicking "open" in the right-click menu, before the client runs the target program, Step 102 can be triggered to automatically determine to prevent the malicious program from damaging the system; and/or to trigger before downloading the target program, thereby pre-defending the malicious program before downloading it to the client. In addition, for some target programs that can be run online, defense protection can also be triggered before running. In short, automatic judgment can be made before any operation on the target program to protect the security of the system.

For the target program determined to be required to be imported into the sandbox, the target is completed in the sandbox The execution of the sequence means: The target program is imported into the sandbox to complete the running of the target program in the sandbox. For example, for a porn player on a website, put the player in a sandbox to run.

(2) Target file

The target file usually refers to an unexecutable file such as a picture, and execution of such an object file needs to be performed by an associated program. For example, for a picture, a picture browser needs to be launched to browse, and the picture browser is an associated program of the picture file.

For the target file that is determined to be imported into the sandbox, the completion of the execution of the target file in the sandbox means: importing the associated program that executes the target file into the sandbox, and the associated program runs in the sandbox. Target file. For example, for an untrusted image file, you can import the image browser into the sandbox to open the image.

For the target file, the user may also trigger the execution of the step 102 in multiple manners, including but not limited to: after the target file or the associated program that executes the target file is downloaded to the client, the target file is run on the client. Trigger before; and/or, trigger before downloading the target file or executing the associated program of the target file online. In summary, automatic judgment can be made before any operation on the target file to protect the security of the system.

(3) User input information

The information input by the user includes information such as a web address, a keyword, and the like input by the user.

If the target object is the information input by the user, the step 102 is triggered to perform security defense when the user inputs the information, that is, whether the information such as the website address and the keyword input by the user is safe and trustworthy, and if not, the step is performed. 103.

For the user input information that is determined to be required to be imported into the sandbox, the completion of the execution of the user input information in the sandbox means: importing the associated program that receives the user input information into the sandbox, and inputting the user according to the user in the sandbox The information runs the associated program. For example, for a suspicious URL, a new browser is opened in the sandbox to link to the website corresponding to the URL, and the browser program is the associated program that receives the URL input.

In combination with the above (1), (2), (3), no matter which kind of target object the user wants to operate, the method shown in Fig. 1 can automatically judge whether the execution needs to be imported into the sandbox. The automatic judgment method provided by the embodiment of the present application includes, but is not limited to: determining whether the target object to be operated meets a preset match. The rule, if it is met, the execution of the target object to be operated needs to be imported into the sandbox; if it is not, the sandbox does not need to be imported.

Specifically, the determining may be: querying a preset database, comparing the target object to be operated with a preset rule in the database, and if queried in the database, matching the matching rule; If it is queried, it does not match the matching rule. That is, the rules for storing various judgments are stored in the database, or the characteristics of the objects that match the matching rules are directly stored. If the target object to be operated is queried in the database, it indicates that the execution of the target object needs to be imported into the sandbox.

Corresponding matching rules are different for different target objects:

1) When the target object to be operated is the target program and/or the target file, determining whether the target object to be operated meets the preset matching rule comprises: determining whether the related information of the target object meets the preset a matching rule; and/or, determining whether the related information of the source program of the target object conforms to a preset matching rule.

The related information of the target object includes:

The file path of the target object, and / or

Encrypted data of the target object (such as MD5), and / or

File attributes of the target object (such as product name, version information, signature issuer, file size, etc.), and/or

Icon feature values (such as icon hash values) of the target object, and / or

The file feature value of the target object (such as a file hash value), and / or

The download source of the target object (such as which website to download from);

That is, the related information of the target object includes at least one of the above information.

Correspondingly, the related information of the source program includes:

The file path of the source program, and / or

Encrypted data from the source program (such as MD5), and / or

File attributes of the source program (such as product name, version information, signature issuer, file size, etc.), and/or

The icon feature value of the source program (such as an icon hash), and / or

File feature values (such as file hash values) of the source program, and/or The source of the download of the source program (such as which website to download from);

That is, the related information of the source program includes at least one of the above information.

Based on the related information of the target object and related information of the source program, the matching rule may be:

Example 1: For pornographic players on the site, the matching rules are as follows:

The source program is: a browser program or a resource manager;

Target file name: Contains "Japan AV" or "Erotic" ...;

The file icon of the target is a specific player icon;

The target file size can be limited to a range, such as: 1MB~10MB;

File description of the target t匕: 3⁄4 port xxxx adult player, xxxx dedicated player.

That is, the player that meets the above rules is judged to be a pornographic player.

Example 2: For an unknown risk e-book, the matching rules are as follows:

Target file name: A keyword containing an "e-book";

The feature value of the target file icon contains: The characteristics of the icon of the e-book. Example 3: For an unknown risky sequencer generator, the matching rules are as follows:

Target file name: There are keywords that contain "serial number generator" or "keygen" or "cracker" or "debug machine";

The feature values of the target file icon include: The characteristics of the icon of the sequencer generator.

The sequence number generator that meets the above rules can be judged as a risky sequence number generator.

In addition to the above-mentioned several matching rules, there may be other rules, such as performing fuzzy matching or full-text matching, prioritizing file name matching, etc., depending on the specific application, and will not be enumerated here.

2) When the target object to be operated is information input by the user, determining whether the target object to be operated meets the preset matching rule comprises: determining whether the information input by the user conforms to a preset matching rule.

For example, it is determined whether the URL input by the user is the URL of some pornographic websites, or whether the keyword input by the user contains information such as "Japanese AV" or "erotic". Letter entered by user The information can be pre-determined whether the website to be browsed by the user or the web page to be searched needs to be placed in a sandbox.

Based on the various matching rules listed above, preferably, before the automatic determination of the matching rule by the target object, the following automatic determination may be preferentially performed, as follows:

1) before determining whether the target object to be operated meets a preset matching rule: creating a process for automatically determining execution of the target object;

Determining whether the parent process of the process is in the sandbox, if yes, the execution of the target object to be operated needs to be imported into the sandbox; if not, continuing to determine whether the target object to be operated meets the preset match rule.

That is, if the process for automatically determining the execution of the target object has a parent process, the process for automatic judgment is called a child process. If the parent process has been imported into the sandbox, indicating that the parent process is untrustworthy, the child process called by the parent process is also untrusted, so the child process should also be imported into the sandbox for execution.

2) determining whether the target object to be operated meets the preset matching rule: determining whether the user selects to import the execution of the target object to be operated into the sandbox, and if yes, performing the target object to be operated The sandbox needs to be imported; if not, it is further determined whether the target object to be operated meets the preset matching rule.

That is, the user can participate in selecting whether to put in the sandbox. If the user has actively selected to put in the sandbox, no automatic judgment of the matching rule is needed.

3) determining whether the target object to be operated meets the preset matching rule: determining whether the target object to be operated is in the white list, and if not in the white list, the target object to be operated is an unknown object And continuing to determine whether the target object to be operated meets the preset matching rule; if in the white list, it is not required to import the sandbox.

The safer target objects are listed in the whitelist, and the target objects in the whitelist can be directly executed without being imported into the sandbox. If the target object to be operated is in the white list, the automatic judgment of the matching rule can be dispensed with. If the target object to be operated is not in the white list, indicating that the target object to be operated is an unknown object, further automatic judgment is required.

4) Before judging whether the target object to be operated meets the preset matching rule: Determining whether the target object to be operated is in the blacklist, if in the blacklist, performing the execution of the target object to be operated needs to be imported into the sandbox; if not in the blacklist, continuing to determine the target to be operated Whether the object meets the preset matching rules.

The target object that is not trusted is listed in the blacklist. If the target object to be operated is in the blacklist, it is directly imported into the sandbox; but if it is not in the blacklist, the pending operation cannot be excluded. The target object must be secure, so it is necessary to continue to judge the matching rules.

In practical applications, if the target object to be operated is in the blacklist, it can also be directly intercepted without being placed in a sandbox, which can be selected by the user.

The above 1) to 4) can be used separately before the judgment of the matching rule, or can be combined before use in the judgment of the matching rule.

Based on the foregoing, in an actual application, the embodiment of the present application further provides the following two implementation manners:

First, according to the request of the client, the server automatically determines whether the execution of the target object to be operated needs to be imported into the sandbox.

Specifically, the server side stores various rules for automatic judgment. If the target program or target file to be operated has been downloaded to the client, when the user clicks and executes, the client sends a request for the judgment to the server, and the server sends the request to the server. Make an automatic judgment. Or, before downloading the target program or target file from the server, the server determines whether to import the sandbox download according to the download request of the client. Alternatively, when the user inputs a web address or a keyword, the server automatically judges based on the user's input.

Secondly, it is automatically determined by the client whether the execution of the target object to be operated needs to import the σ phase.

In this case, the client stores various rules for automatic judgment and updates it regularly from the server. The client can automatically judge the user before the target object is operated.

In summary, the foregoing embodiment provides a method for intelligent determination, which can automatically determine whether the execution of the target object needs to be imported into a sandbox before the user performs an operation on the target object, thereby bringing the following advantages:

First, it can help users decide which risky programs need to run in the sandbox without The user must judge by himself;

Secondly, avoiding the loss of user data by placing the safe and risk-free program in the sandbox; Thirdly, without the user's participation, the user's operation is not affected, and the ease of use is high. Based on the above, the present application also provides the preferred embodiment shown in FIG. 2.

Referring to Fig. 2, there is shown a flow chart of a method for defending by using a sandbox according to a preferred embodiment of the present application.

Taking the target object as the target program as an example, the target object is similar to the target file and the user input information, and will not be described in detail.

The judgment process of the entire target program to be operated automatically enters the sandbox is as follows:

Step 201, creating a process;

Step 202: Determine whether the parent process is in a sandbox;

If the parent process is in the sandbox, then go to step 208;

If the parent process is not in the sandbox, proceed to step 203.

Step 203, determining whether the user chooses to import the execution of the target program to be operated into the sandbox; if the user has selected to import the execution of the target program to be operated into the sandbox, then the process proceeds to step 208;

If the user does not choose to import the execution of the target program to be operated into the sandbox, continue with the steps

204.

Step 204: Determine whether the target program to be operated is in a white list.

If it is in the white list, then go to step 209;

If it is not in the white list, it is an unknown program, and step 205 is continued.

Step 205: Determine whether the target object to be operated is in a blacklist.

If it is in the blacklist, then go to step 208;

If it is not in the blacklist, proceed to step 206.

Step 206: Determine whether the target program is a specific type of program;

That is, it is judged whether it is a specific type of program according to various matching rules;

If yes, proceed to step 207; If not, then go to step 209.

Step 207, a pop-up prompt window prompts the user that the target program is to be executed in the sandbox; if the user selects to import, the target program is added to the sandbox running list.

In step 208, the operation of writing, deleting, and modifying the file/registry of the target program is started in the sandbox, and the process ends.

In step 209, the target program is run in a general environment (non-sandbox mode), and the process ends. It should be noted that the order of the foregoing steps 203 to 205 can also be replaced, but all need to be before step 206.

It should be noted that, for the foregoing method embodiments, for the sake of brevity, they are all described as a series of action combinations, but those skilled in the art should understand that the present application is not limited by the described action sequence. Because certain steps may be performed in other sequences or concurrently in accordance with the present application. In addition, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application. Based on the above, the present application also provides a corresponding device embodiment, as shown in FIG.

Referring to Fig. 3, there is shown a block diagram of a device for defense using a sandbox according to a preferred embodiment of the present application.

The device may include the following modules:

The judging module 31 is configured to automatically determine whether the execution of the target object to be operated needs to be imported into the sandbox before performing the operation on the target object;

The execution module 32 is configured to: if the judgment result of the determination module 31 is that the sandbox needs to be imported, the target object is imported into the sandbox and the execution of the target object is completed in the sandbox; if not, the target can be completed outside the sandbox The execution of the object.

The target object includes but is not limited to: a target program, an object file, and information input by the user.

Execution module 32, when the target object is imported into the sandbox and the execution of the target object is completed in the sandbox:

If the target object is a target program, the execution module 32 imports the target program Sandbox, complete the operation of the target program in the sandbox;

If the target object is a target file, the execution module 32 imports the associated program that executes the target file into the sandbox, and the target file is run by the associated program in the sandbox;

If the target object is information input by the user, the executing module 32 imports the associated program that receives the user input information into a sandbox, and runs the associated program according to the user input information in the sandbox; Information includes URLs and/or keywords.

Preferably, the determining module 31 is configured to: if the target object is a target program, the determining module 31 automatically downloads the target program to be downloaded to the client, and automatically determines the to-be-operated operation before the client runs the target program Whether the execution of the target object needs to be imported into the sandbox; and/or, before downloading the target program, automatically determining whether the execution of the target object to be operated needs to be imported into the sand phase;

If the target object is the target file, the determining module 31 downloads the target file or the associated program that executes the target file to the client, and automatically determines the target to be operated before the client runs the target file. Whether the execution of the object needs to be imported into the sandbox; and/or, before downloading the target file or executing the associated program of the target file online, automatically determining whether the execution of the target object to be operated needs to be imported into the sandbox;

If the target object is information input by the user, the determining module 31 automatically determines whether the execution of the target object to be operated needs to be imported into the sandbox when the user inputs the information.

Further, the determining module 31 may include:

The rule judging module 311 is configured to determine whether the target object to be operated meets a preset matching rule before performing an operation on the target object, and if yes, the execution of the target object to be operated needs to be imported into the sandbox; If it does not match, you do not need to import the sandbox.

Further, when the target object to be operated is the target program and/or the target file, the rule determining module 311 determines whether the related information of the target object meets a preset matching rule; and/or determines the target Whether the information related to the source program of the object conforms to a preset matching rule 'J; wherein the related information of the target object includes a file path of the target object, and/or encrypted data, and/or file attributes, and/or icons The feature value, and/or the file feature value, and/or the download source, ie, at least one of the above information; the related information of the source program includes the file of the source program Path, and/or encrypted data, and/or file attributes, and/or icon feature values, and/or file feature values, and/or download sources, ie, at least one of the above information;

When the target object to be operated is information input by the user, the rule determining module 311 determines whether the information input by the user meets a preset matching rule.

Preferably, the determining module 31 may further include:

The parent process judging module 312 is configured to: after the rule judging module judges 311 whether the target object to be operated meets the preset matching rule, and after creating a process for automatically determining the execution of the target object, determining the process Whether the parent process is in the sandbox, if yes, the execution of the target object to be operated needs to be imported into the sandbox, triggering the execution module 32 to import the target object into the sandbox and in the sandbox The execution of the target object is completed; if not, the rule determination module 311 is triggered to continue to determine whether the target object to be operated meets a preset matching rule.

Preferably, the determining module 31 may further include:

The user selection judging module 313 is configured to determine whether the user selects to import the execution of the target object to be operated into the sandbox. If yes, the execution of the target object to be operated needs to be imported into the sandbox, and the execution module 32 is triggered. Importing the target object into the sandbox and completing execution of the target object in the sandbox; if not, triggering the rule determination module 311 to continue to determine whether the target object to be operated meets a preset match rule.

Preferably, the determining module 31 may further include:

The whitelist determination module 314 is configured to determine whether the target object to be operated is in the whitelist. If the target object to be operated is not in the whitelist, the target object to be operated is an unknown object, and the rule determination module 311 is triggered to continue to determine the location. Whether the target object of the operation is in compliance with the preset matching rule; if it is in the white list, it is not necessary to import the sandbox.

Preferably, the determining module 31 may further include:

The blacklist determination module 315 is configured to determine whether the target object to be operated is in the blacklist. If the target object to be operated is in the blacklist, the execution of the target object to be operated needs to be imported into the sandbox, and the execution module 32 is triggered. The target object is imported into the sandbox and the execution of the target object is completed in the sandbox; if not in the blacklist, the rule determination module 311 is triggered to continue to determine whether the target object to be operated meets the preset Matching rules. Preferably, the device may further include:

The prompting module 33 is configured to: after the execution module 32 determines that the sandbox needs to be imported, import the target object into the sandbox and complete the execution of the target object in the sandbox, and pop up a prompt window to prompt the user whether Importing a sandbox; and invoking the execution module 32 to import the target object into the sandbox according to the user's positive input and complete execution of the target object in the sandbox.

For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The above-mentioned device that uses the sandbox technology for defense can be deployed on the server side or on the client side. Before the user performs an operation on the target object, it is automatically determined whether the execution of the target object needs to be imported into the sandbox, and the user is determined to determine which The risk program needs to be run in the sandbox to avoid the loss of user data caused by placing the safe and risk-free program in the sandbox, and because it does not require user participation, it does not affect the user's operation and is easy to use.

The device of the present application further provides a security browser, and the browser includes a device for performing system defense by using a sandbox technology as described in the foregoing embodiment of FIG. 3, and The method described in FIG. 1 or FIG. 2 is used to automatically determine whether the execution of the target object to be operated needs to be imported into the sandbox. For details, refer to the related contents of FIG. 1, FIG. 2 and FIG. 3 above, and no further description is provided.

In addition, based on the method for defending using the sandbox technology of the present application, the embodiment of the present application further provides a computer readable recording medium on which a program for performing the method for defending using the sandbox technology of the present application is recorded. The computer readable recording medium includes any mechanism for storing or transmitting information in a form readable by a computer. For example, a machine-readable medium includes a read only memory (ROM), a random access memory (RAM), a magnetic disk storage medium, an optical storage medium, a flash storage medium, an electrical, optical, acoustic, or other form of propagated signal, etc. (eg, Carrier, infrared signal, data signal, etc.). The various embodiments in the present specification are described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same similar parts between the various embodiments can be referred to each other. Finally, it should also be noted that in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities. There is any such actual relationship or order between operations.

Moreover, "and/or" in the above means that both the relationship of "and" and the relationship of "or" are included in the text, wherein: if the relationship between the scheme A and the scheme B is "and", it indicates an embodiment. The scheme A and the scheme B may be included at the same time; if the relationship between the scheme A and the scheme B is "or", it means that the scheme A may be separately included in an embodiment, or the scheme B may be separately included.

The method, the device and the security browser for defending against the sandbox provided by the present application are described in detail above. The principles and implementation manners of the present application are described in the specific examples, and the description of the above embodiments is described. It is only used to help understand the method of the present application and its core ideas; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in specific implementation manners and application scopes. The contents of this specification are not to be construed as limiting the application.

Claims

Claim

1. A method of using a sandbox for defense, including:

Before performing an operation on the target object, automatically determining whether the execution of the target object to be operated needs to be imported into the sandbox;

If it is determined that a sandbox needs to be imported, the target object is imported into the sandbox and execution of the target object is completed in the sandbox.

2. The method according to claim 1, wherein the step of importing the target object into the sandbox and completing execution of the target object in the sandbox comprises:

Or, if the target object is an object file, import the associated program that executes the target file into a sandbox, and the target file is run by the associated program in a sandbox;

Or if the target object is the information input by the user, importing the associated program that receives the user input information into the sandbox, and running the associated program according to the user input information in the sandbox; the information input by the user includes the URL And / or keywords.

3. The method according to claim 2, wherein the step of automatically determining whether execution of the target object to be operated needs to be imported into a sandbox before performing an operation on the target object comprises: if the target object is a target a program, after downloading the target program to the client, automatically determining whether execution of the target object to be operated needs to be imported into a sandbox before the client runs the target program; and/or downloading the target program Before, it is automatically determined whether the execution of the target object to be operated needs to be imported into a sandbox;

Or, if the target object is a target file, after downloading the target file or the associated program that executes the target file to the client, automatically determining the target object to be operated before the client runs the target file Whether it is necessary to import a sandbox; and/or, before downloading the target file or executing an associated program of the target file online, automatically determining whether execution of the target object to be operated needs to be imported into a sandbox;

Alternatively, if the target object is information input by the user, when the user inputs the information, it is automatically determined whether the execution of the target object to be operated needs to be imported into the sandbox.

The method according to any one of claims 1 to 3, wherein the automatic determination is to be operated The steps of whether the execution of the target object needs to be imported into the sandbox include:

It is determined whether the target object to be operated meets the preset matching rule. If it is met, the execution of the target object to be operated needs to be imported into the sandbox; if not, the sandbox is not required to be imported.

The method according to claim 4, further comprising: before the step of determining whether the target object to be operated meets a preset matching rule, creating: a process for automatically determining execution of the target object;

Determining whether the parent process of the process is in a sandbox, and if so, performing the step of importing the target object into the sandbox and completing execution of the target object in the sandbox; if not, The step of determining whether the target object to be operated conforms to a preset matching rule is continued.

The method according to claim 4, wherein before the step of determining whether the target object to be operated meets a preset matching rule, the method further includes:

Determining whether the user chooses to import the execution of the target object to be operated into the sandbox, and if so, performing the step of importing the target object into the sandbox and completing execution of the target object in the sandbox If no, the step of determining whether the target object to be operated meets the preset matching rule is continued.

Determining whether the target object to be operated is in the whitelist, if not in the whitelist, the target object to be operated is an unknown object, and continuing to determine whether the target object to be operated meets a preset matching rule Step; if in the white list, the target object to be operated does not need to be imported into the sandbox.

Determining whether the target object to be operated is in a blacklist, and if in the blacklist, performing the step of importing the target object into the sandbox and completing execution of the target object in the sandbox; If it is not in the blacklist, the step of determining whether the target object to be operated meets the preset matching rule is continued.

9. The method according to claim 4, wherein the target object to be operated is determined to be The steps for meeting the preset matching rules include:

The preset database is queried, and the target object to be operated is compared with the preset rule in the database. If the query is found in the database, the matching rule is met; if not, the matching rule is not met.

The method according to claim 4, wherein, when the target object to be operated is a target program and/or a target file, the step of determining whether the target object to be operated conforms to a preset matching rule Includes:

Determining, according to the information of the target object, whether the target object meets a preset matching rule;

And/or, according to the information of the source program of the target object, determining whether the target object meets a preset matching rule.

11. The method according to claim 10, wherein

The information of the target object includes at least one of the following: a file path of the target object, an encrypted data, a file attribute, an icon feature value, a file feature value, and a download source;

The information of the source program includes at least one of the following: a file path of the source program, encrypted data, file attributes, icon feature values, file feature values, and download sources.

The method according to claim 4, wherein, when the target object to be operated is the information input by the user, the step of determining whether the target object to be operated meets the preset matching rule comprises:

It is determined whether the information input by the user meets a preset matching rule.

The method according to any one of claims 1 to 3, wherein the step of automatically determining whether the execution of the target object to be operated needs to be imported into the sandbox comprises:

According to the request of the client, the server automatically determines whether the execution of the target object to be operated needs to be imported into the sandbox;

And/or, the client automatically determines whether the execution of the target object to be operated needs to import the sigma phase.

14. The method according to any one of claims 1 to 3, wherein after determining that a sandbox needs to be imported, the target object is imported into the sandbox and execution of the target object is completed in the sandbox Previously, it also included:

A pop-up prompt window prompts the user whether to import the sandbox; and the step of importing the target object into the sandbox and performing the execution of the target object in the sandbox is performed according to the positive input of the user.

15. A device for using a sandbox for defense, comprising:

16. The apparatus according to claim 15, wherein the execution module, when the target object is imported into the sandbox and the execution of the target object is completed in the sandbox,

The device according to claim 16, wherein the determining module is configured to: if the target object is a target program, download the target program to the client, before the client runs the target program Automatically determining whether execution of the target object to be operated needs to be imported into a sandbox; and/or automatically determining whether execution of the target object to be operated needs to be imported into a sandbox before downloading the target program;

Or, if the target object is a target file, after downloading the target file or the associated program that executes the target file to the client, automatically determining the target object to be operated before the client runs the target file Whether it is necessary to import a sandbox; and/or, before downloading the target file or executing an associated program of the target file online, automatically determining whether execution of the target object to be operated needs to be imported into a sandbox; Alternatively, if the target object is information input by the user, when the user inputs the information, it is automatically determined whether the execution of the target object to be operated needs to be imported into the sandbox.

The apparatus according to any one of claims 15 to 17, wherein the judging module comprises: a rule judging module, configured to determine whether the target object to be operated conforms to a preset before performing an operation on the target object Matching rules, if they are met, the execution of the target object to be operated needs to be imported into the sandbox; if not, the sandbox does not need to be imported.

The device according to claim 18, wherein the determining module further comprises: a parent process determining module, configured to: before the rule determining module determines whether the target object to be operated meets a preset matching rule, After creating a process for automatically determining the execution of the target object, determining whether the parent process of the process is in a sandbox, and if so, triggering the execution module to import the target object into the sandbox and Executing execution of the target object in the sandbox; if not, triggering the rule determination module to continue to determine whether the target object to be operated meets a preset matching rule.

The device according to claim 18, wherein the determining module further comprises: a user selection determining module, configured to determine whether the user selects to import the execution of the target object to be operated into the sandbox, and if so, trigger The execution module imports the target object into the sandbox and completes execution of the target object in the sandbox; if not, triggers the rule determination module to continue to determine whether the target object to be operated meets the pre-target Match rules.

The device of claim 18, wherein the determining module further comprises: a whitelist determining module, configured to determine whether the target object to be operated is in a whitelist, and if not in the whitelist, The target object to be operated is an unknown object, and the rule determination module is triggered to continue to determine whether the target object to be operated meets a preset matching rule; if in the white list, the target object to be operated does not need to be imported. sandbox.

The device of claim 18, wherein the determining module further comprises: a blacklist determining module, configured to determine whether the target object to be operated is in a blacklist, and if in the blacklist, triggering The execution module imports the target object into the sandbox and completes execution of the target object in the sandbox; if not in the blacklist, triggering the rule determination module to continue to determine whether the target object to be operated is Match the preset matching rules.

The device according to claim 18, wherein the rule determining module is configured to: when the target object to be operated is a target program and/or a target file, determine the information according to the information of the target object Whether the target object meets the preset matching rule; and/or, according to the information of the source program of the target object, determining whether the target object meets a preset matching rule; wherein, the information of the target object includes at least the following a: a file path of the target object, encrypted data, file attributes, icon feature values, file feature values, download sources; the source program information includes at least one of the following: a file path of the source program, encrypted data, file attributes, icons Feature value, file feature value, download source;

The device according to any one of claims 15 to 17, wherein the device further comprises: a prompting module, configured to: after the execution module determines that the sandbox needs to be imported, import the target object into the sandbox And before the execution of the target object is completed in the sandbox, a pop-up prompt window prompts the user whether to import the sandbox; and invokes the execution module according to the positive input of the user to import the target object into the sandbox and The execution of the target object is completed in the sandbox.

A security browser comprising the apparatus for defense using a sandbox as claimed in any of claims 15 to 24.

A computer readable recording medium having recorded thereon a method for performing the method of any one of claims 1 to 14.

27. A secure browser for performing the method of using a sandbox for defense as claimed in any one of claims 1 to 14.